[cfinke]

Who can be cookie-bombed? Blogging/hosting/website/homepage platforms: Wordpress, Blogspot, Tumblr, Heroku, etc.

WordPress.com would not be vulnerable since users cannot upload or execute arbitrary JavaScript.